{"api_version":"1","generated_at":"2026-07-23T10:42:44+00:00","cve":"CVE-2017-3761","urls":{"html":"https://cve.report/CVE-2017-3761","api":"https://cve.report/api/cve/CVE-2017-3761.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2017-3761","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2017-3761"},"summary":{"title":"CVE-2017-3761","description":"The Lenovo Service Framework Android application executes some system commands without proper sanitization of external input. In certain cases, this could lead to command injection which, in turn, could lead to remote code execution.","state":"PUBLISHED","assigner":"lenovo","published_at":"2017-10-17 20:29:00","updated_at":"2025-04-20 01:37:25"},"problem_types":["CWE-78","Remote code execution"],"metrics":[{"version":"3.0","source":"nvd@nist.gov","type":"Primary","score":"9.8","severity":"CRITICAL","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"10","severity":"","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C","baseScore":10,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"}}],"references":[{"url":"https://support.lenovo.com/us/en/product_security/LEN-15374","name":"https://support.lenovo.com/us/en/product_security/LEN-15374","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"Lenovo Android Tablet and Lenovo VIBE, Moto, and ZUK Mobile Phone Remote Code Execution Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-3761","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-3761","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Lenovo Group Ltd.","product":"Service Framework application","version":"affected various versions","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2017","cve_id":"3761","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"lenovo","cpe5":"service_framework","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"android","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-05T14:39:41.039Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://support.lenovo.com/us/en/product_security/LEN-15374"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"Service Framework application","vendor":"Lenovo Group Ltd.","versions":[{"status":"affected","version":"various versions"}]}],"datePublic":"2017-10-05T00:00:00.000Z","descriptions":[{"lang":"en","value":"The Lenovo Service Framework Android application executes some system commands without proper sanitization of external input. In certain cases, this could lead to command injection which, in turn, could lead to remote code execution."}],"problemTypes":[{"descriptions":[{"description":"Remote code execution","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-10-17T19:57:01.000Z","orgId":"da227ddf-6e25-4b41-b023-0f976dcaca4b","shortName":"lenovo"},"references":[{"tags":["x_refsource_CONFIRM"],"url":"https://support.lenovo.com/us/en/product_security/LEN-15374"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"psirt@lenovo.com","DATE_PUBLIC":"2017-10-05T00:00:00","ID":"CVE-2017-3761","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Service Framework application","version":{"version_data":[{"version_value":"various versions"}]}}]},"vendor_name":"Lenovo Group Ltd."}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The Lenovo Service Framework Android application executes some system commands without proper sanitization of external input. In certain cases, this could lead to command injection which, in turn, could lead to remote code execution."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Remote code execution"}]}]},"references":{"reference_data":[{"name":"https://support.lenovo.com/us/en/product_security/LEN-15374","refsource":"CONFIRM","url":"https://support.lenovo.com/us/en/product_security/LEN-15374"}]}}}},"cveMetadata":{"assignerOrgId":"da227ddf-6e25-4b41-b023-0f976dcaca4b","assignerShortName":"lenovo","cveId":"CVE-2017-3761","datePublished":"2017-10-17T20:00:00.000Z","dateReserved":"2016-12-16T00:00:00.000Z","dateUpdated":"2024-09-17T03:29:06.189Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2017-10-17 20:29:00","lastModifiedDate":"2025-04-20 01:37:25","problem_types":["CWE-78","Remote code execution"],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C","baseScore":10,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":10,"acInsufInfo":true,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:lenovo:service_framework:-:*:*:*:*:android:*:*","matchCriteriaId":"4A00A993-C187-471B-B5A4-66B69C86FC6B"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2017","CveId":"3761","Ordinal":"1","Title":"CVE-2017-3761","CVE":"CVE-2017-3761","Year":"2017"},"notes":[{"CveYear":"2017","CveId":"3761","Ordinal":"1","NoteData":"The Lenovo Service Framework Android application executes some system commands without proper sanitization of external input. In certain cases, this could lead to command injection which, in turn, could lead to remote code execution.","Type":"Description","Title":"CVE-2017-3761"},{"CveYear":"2017","CveId":"3761","Ordinal":"2","NoteData":"2017-10-17","Type":"Other","Title":"Published"},{"CveYear":"2017","CveId":"3761","Ordinal":"3","NoteData":"2017-10-17","Type":"Other","Title":"Modified"}]}}}